Towards Transparency in Email Tracking

Abstract

Tracking technologies have become ubiquitous, not only on websites but also in email messages. However, while protection and transparency tools exist for the web, no such tools exist for email messages, thus obscuring privacy violations. We introduce the PrivacyMail platform to assist with the automated analysis of email messages. The platform automatically analyzes commercial mailing lists, making it easier to detect different forms of tracking. Our platform introduces transparency about the practices of companies, and serves as a tool for regulators, data protection professionals and consumers alike. Our preliminary results show widespread email tracking, where opening an email can result in information being sent to up to 13 third parties, in some cases disclosing the users' email address in the process.

Trackers in Your Inbox: Criticizing Current Email Tracking Practices

“…In fact it has been suggested that almost 16% of personal conversation emails and 99% of bulk email communications in users' inboxes contain some form of tracking mechanisms [26]. These findings are also confirmed by several academic studies regarding newsletter emails [22,4,3].…”

“…Next, the request-URL represents the address of the remote resource. In newsletter emails, senders often embed personalized tracking tokens in the request-URL [9,22,15,17]. Such a tracking token could be any string that maps to the recipient email address, or identity, at the server side.…”

Open About the Open-Rate?

“…They considered these tokens as Personally Identifying Information (PII) and looked for cases where they are shared with third parties. Haupt et al [21] and Maass et al [30] use multiple subscription to find personalized URLs, by comparing the URL structure of emails sent to multiple users.…”

“…Previous studies consider the distribution of third-parties in emails as indication of email tracking [4,11,30,23]. In these studies, the URL of third-party contents use a different domain name than the email sender, or the website on which the email address was registered.…”

“…Especially, with personalized parameter the HTTP requests act as individual read receipts for emails enabling senders to obtain fine grained information about a user's interaction with their email such as time of opening in addition to devices and software used for opening the email. Concerns about the privacy implications of email tracking using personalized URLs has been raised since 1995 [45] and previous academic works revealed the prevalence of this method of tracking in marketing emails [4,21,11,30].…”